ID. Date of interview 
date 30/01/20 


ID. Time interview started 
start 42:10:33 


ID.end Completion date of interview 
Date 30/01/20 


ID.end Time interview ended 
14:23:35 


ID. Duration of interview 
time 133.03 


Start of new case 


Q1 


Does the draft guidance cover the relevant issues about the right of access? 
© Yes 
©) No 

©) Unsure / don't know 

If no or unsure/don’t know, what other issues would you like to be covered in it? 


Q2 


Does the draft guidance contain the right level of detail? 


© Yes 
©) No 

©) Unsure / don't know 

If no or unsure/don't know, in what areas should there be more detail within the draft 
guidance? 


Q3 


Does the draft guidance contain enough examples? 
C) Yes 

©) No 

© Unsure / don't know 


If no or unsure/don’t know, please provide any examples that think should be included in 
the draft guidance. 


More examples are always helpful. | really like the examples that have been given but think more would 
be good. Perhaps some further examples around third party requests e.g. financial advisors or other 
advisors when it is clearly a "fishing expedition" 


Q4 We have found that data protection professionals often struggle with applying and 
defining ‘manifestly 
unfounded or excessive’ subject access requests. We would like to include a wide 
range of examples 
from a variety of sectors to help you. Please provide some examples of manifestly 
unfounded and excessive 
requests below (if applicable). 


We have had situations were claims management companies are selling their 
"service" to others i.e. a platform that spits out 100s of DSARs to multiple providers 
- with no justifiable basis on why those providers are targetted. For example they 
sell this service to Solicitors that has been appointed by the Court of Protection for 
mental incapacity. Whilst we appreciate that the guidance does make mention of the 
Solicitors acting in this capacity as being legitimate - I do not think they are aware 
that their own personal data eg copies of passport and address are being circulated 
to over 100 organisations (as per the guidance we have contacted them to inform 
them of our concerns). Having vulnerable people's personal details blanket sent to 
multiple companies with no encryption or password protection on the off chance we 
may have some information on them is surely unfounded? After contacting them a 
lot of them admit that they do not believe we would have any personal data on the 
individuals concerned. As we are data processors for pension schemes not providing 
us with the data controller's name is also an issue (if we do hold data) because we 
cannot obtain consent to release the personal data without passing them to the data 


Q5 Ona scale of 1-5 how useful is the draft guidance? 


1-Notatall 2-—Slightly Moderately 4-Very 5- Extremely 
useful useful useful useful useful 


© 


Q6 Why have you given this score? 


as per response to Q4 - the guidance is helping in confirming we have been taking 
the correct actions however we feel it could go further in some scenarios. 


Q7 To what extent do you agree that the draft guidance is clear and easy to understand? 


Strongly Neither agree Strongly 
disagree Disagree nor disagree Agree agree 


© 


Q8 Please provide any further comments or suggestions you may have about the draft 
guidance. 


Perhaps an example of when personal data stored on someones own device counts 
as in scope or not eg whatsapp work group on a personal phone? 


Q9 Are you answering as: 
O An individual acting in a private capacity (eg someone providing their views as a member of the public) 
(`) An individual acting in a professional capacity 
© On behalf of an organisation 
(C) Other 
Please specify the name of your organisation: 
lane clark and peacock 
What sector are you from: 


professional advisors/financial services/pensions 


Q10 How did you find out about this survey? 
©) ICO Twitter account 
(_) ICO Facebook account 
(`) ICO LinkedIn account 
(C) ICO website 
( `) ICO newsletter 
(_) ICO staff member 
C`) Colleague 
) Personal/work Twitter account 
(_) Personal/work Facebook account 
©) Personal/work LinkedIn account 
C) Other 
If other please specify: 


